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MEMORANDUM  FOR  DIRECTOR,  DEFENSE  LOGISTICS  AGENCY 

SUBJECT:  Audit  Report  on  Procurement  Systems  Year  2000  End-to-End  Tests 
(Report  No.  D-2000-035) 


We  are  providing  this  report  for  information  and  use.  This  report  is  one  in  a 
series  being  issued  by  the  Injector  General,  DoD,  in  accordpce  with  an  informal 
partnership  with  the  DoD,  Chief  Information  Officer  to  identify  progress  made  by  DoD 
Components  that  are  preparing  information  and  technology  systems  for  year  2000 
compliance.  We  considered  management  comments  on  a  draft  of  this  report  when 
preparing  the  final  report. 

The  Defense  Logistics  Agency  comments  conformed  to  the  requirements  in 
DoD  Directive  7650.3;  therefore,  no  additional  comments  are  required. 

We  appreciate  the  courtesies  extended  to  the  audit  staff.  Questions  on  the  audit 
should  be  directed  to  Mr.  Garold  E.  Stephenson  at  (703)  604-9332  (DSN  664-9332) 
(gstephenson@dodig.osd.mil)  or  Mr.  Eugene  E.  Kissner  at  (703)  604-9323 
(DSN  664-9323)  (ekissner@dodig.osd.mil).  See  Appendbc  C  for  the  report 
distribution.  The  audit  team  members  are  listed  inside  the  back  cover. 


Robert  J.  Lieberman 
Assistant  Inspector  General 
for  Auditing 
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Executive  Summary 


Litroduction.  This  report  is  one  in  a  series  being  issued  by  the  Inspector  General, 
DoD,  in  accordance  with  an  informal  partnership  with  the  Chief  Information  Officer, 
DoD,  to  monitor  DoD  efforts  to  address  the  year  20(X)  computing  challenge.  This 
report  addresses  year  2000  issues  that  pertain  to  the  end-to-end  testing  that  occurred  on 
procurement  systems.  For  a  listing  of  audit  projects  addressing  the  issue,  see  the  year 
2000  web  page  on  the  IGNET  at  ht^://www.ignet.gov. 

The  “DoD  Year  2000  Management  Plan,”  Appendix  I,  “Guidelines  to  Support  DoD 
Y2K  Operational  Readiness,”  assigns  responsibility  to  the  Secretary  of  Defense 
Principal  St^f  Assistants  for  ensuring  the  end-to-end  functional  process  flows  that 
support  their  functional  area  are  addressed  either  in  a  Joint  Staff/Commander  in  Chief 
year  2000  operation^  evaluation,  a  Service-sponsored  system  integration  test,  or 
through  a  functional-area  year  2000  end-to-end  test.  Appendix  I  also  states  that  the 
Principal  Staff  Assistants’  re^onsibilities  include  planning,  executing,  and  evaluating 
all  mission-critical  systems  not  otherwise  tested  and  for  ensuring  that  processes  that  fall 
within  their  purview  are  evaluated.  The  Director,  Defense  Procurement  performs  those 
functions  for  procurement. 

Objectives.  The  overall  objective  was  to  evaluate  the  effectiveness  of  the  planned  year 
2000  end-to-end  tests  for  procurement  systems.  Specifically,  we  reviewed  the  test 
plans  and  the  results  of  selected  test  events  for  procurement  systems  that  were 
designated  as  mission-critical  and  non-mission  critical  by  the  Military  Services  and 
Defense  agencies,  to  determine  if  the  tests  were  adequately  planned  and  executed,  and 
the  results  were  adequately  documented. 

Results.  More  needs  to  be  done  to  provide  assurance  that  the  Defense  Logistics 
Agency  Mechanization  of  Contract  Administration  Services  procurement  system  will 
function  properly  in  the  year  2000.  The  Defense  Logistics  Agency  conducted 
end-to-end  tests  of  its  mission-critical  procurement  systems,  but  did  not  test  external 
interfaces  for  any  of  its  mission-critical  procurement  systems.  Without  additional 
chec^,  the  Director,  Defense  Logistics  Agency  cannot  ensure  that  the  procurement 
process  will  not  be  adversely  affected  by  data  from  external  interface  partners.  At  a 
minimum,  checks  are  needed  to  ensure  that  the  window  being  used  to  interpret  the 
century  from  the  year  is  clearly  defined  and  communicated  to  the  interface  partners  to 


mitigate  the  risk  that  the  Mechanization  of  Contract  Administration  Services 
procurement  system  will  not  function  properly  in  year  2000.  See  the  Finding  section  of 
the  report  for  a  discussion  of  the  audit  results. 

Summary  of  Recommendation.  We  recommend  that  the  Director,  Defense  Logistics 
Agency  check  all  external  interfaces  of  the  Mechanization  of  Contract  Administration 
Services  procurement  system  to  ensure  that  the  window  being  used  to  interpret  the 
century  from  the  year  is  clearly  defined  and  successfully  communicated  to  the  interface 
partners. 

Management  Comments.  The  Defense  Logistics  Agency  agreed  to  conduct  a  risk 
mitigation  study  of  all  external  interfaces  between  the  Mechanization  of  Contract 
Adininistration  Services  procurement  system  and  the  systems  that  use  it.  The  study  will 
concentrate  on  the  specific  windowing  techniques  used  by  the  Mechanization  of 
Contract  Administration  Services  procurement  system  and  its  external  partner  systems. 
Memoranda  of  Agreement  wiA  the  external  partners  will  be  updated  or  implemented 
where  necessary.  A  discussion  of  management  comments  is  in  the  Finding  section  of 
the  report  and  Ae  complete  text  of  management  comments  is  in  the  Management 
Comments  section. 


11 


Table  of  Contents 


Executive  Summary  i 

Introduction 

Background  1 

Objectives  2 

Finding 

End-to-End  Testing  of  Procurement  Systems  3 

Appendixes 

A.  Audit  Process 

Scope  10 

Methodology  11 

Management  Control  Program  1 1 

Summary  of  Prior  Coverage  1 1 

B.  Non-Mission  Critical  Procurement  Systems  and  Testing  Status  12 

C.  Report  Distribution  15 

Man^ement  Comments 


Defense  Lx>gistics  Agency 


17 


Background 


The  Year  2000  Problem.  The  year  2000  (Y2K)  problem  is  the  term  most  often 
used  to  describe  the  potential  failure  of  information  technology  systems  to 
process  or  perform  ckte-related  functions.  The  Y2K  problem  is  rooted  in  the 
way  that  automated  information  systems  record  and  compute  dates.  Systems 
have  typically  used  two  digits  to  represent  the  year  such  as  “98”  representing 
1998  to  conserve  electronic  data  storage  capacity  and  to  reduce  operating  costs. 
With  the  two-digit  format,  however,  Ae  year  2000  is  indistinguishable 
from  1900.  Calculations  of  Y2K  dates  are  further  complicated  because  2000  is 
a  leap  year,  the  first  century  leap  year  since  1600.  Computer  systems  and 
applications  must  recognize  Febmary  29,  2000,  as  a  valid  date. 

The  DoD  operates  thousands  of  information  systems.  These  systems  support 
every  function  of  the  DoD  enterprise,  including  core  business  functions  such  as 
contract,  financial,  logistics,  and  personnel  management  and  health  care. 

Failure  of  the  information  systems  to  recognize  the  changes  that  Y2K  brings  will 
result  in  incorrect  data  being  generated  and  could  have  detrimental  effects  on 
information  systems.  The  problem  can  become  increasingly  complex  since 
corrupted  ^ta  can  be  perpetuated  through  interfaces  with  other  feeder  systems. 

Executive  Order.  On  February  4,  1998,  the  President  issued  Executive 
Order  13073,  “Year  2000  Conversion,”  mandating  that  Federal  agencies  do 
what  is  necessary  to  ensure  that  no  critical  Federal  program  experiences 
disruption  because  of  the  Y2K  problem.  The  Executive  Order  also  retires  that 
the  head  of  each  agency  ensure  that  efforts  to  address  Y2K  issues  receive  the 
highest  priority. 

DoD  Y2K  Management  Plan.  As  the  DoD,  Chief  Information  Officer,  the 
Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and 
Intelligence)  issued  the  “DoD  Year  2000  Management  Plan”  (DoD  Y2K 
Management  Plan)  in  April  1997.  The  current  version  of  the  plan  is  dated 
December  1998.  The  DoD  Y2K  Management  Plan  provides  Ae  overall  DoD 
strategy  and  guidance  to  inventory,  prioritize,  fix  or  retire  systems,  and  monitor 
test  progress.  The  DoD  Y2K  Management  Plan  states  that  a  Y2K  program  goal 
is  to  ensure  Ae  continuance  of  a  mission-capable  force  that  is  able  to  execute  the 
National  Military  Strategy  before,  on,  and  after  January  1,  2000,  unaffected  by 
the  failure  of  mission  critical  or  support  systems  to  properly  process  Y2K  date- 
related  information.  The  DoD  Management  Plan  states  that  the  DoD,  Chief 
Information  Officer  has  overall  responsibility  for  overseeing  the  DoD  solution  to 
the  Y2K  problem. 

Deputy  Secretary  of  Defense  Memorandum.  The  Deputy  Secretary  of 
Defense,  memorandum,  “Year  2000  Verification  of  National  Security 
Capabilities,”  August  24,  1998,  tasked  each  Principal  Staff  Assistant  of  the 
Office  of  the  Secretary  of  Defense  to  verify  that  all  functions  under  his  or  her 
purview  will  continue  unaffected  by  Y2K  issues.  The  memorandum  requires 
that  the  designated  Principal  Staff  Assistant  provide  plans  for  Y2K-related 
end-to-end  testing  of  each  process  within  their  functions  to  ensure  Y2K 
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compliance  in  their  functional  areas.  The  end-to-end  testing  was  to  be 
conducted  during  the  first  half  of  1999.  The  testing  was  to  be  planned  and 
conducted  from  a  mission  perspective,  rather  than  a  system  perspective,  to 
increase  the  confidence  that  any  errors  or  omissions  in  system  remediation 
would  be  found. 

Capstone  Test  Plan  for  Procurement  Systems  for  Y2K  Compliance.  The 
Capstone  Test  Plan  for  Procurement  Systems  for  Y2K  Compliance  (tihe 
Capstone  Plan)  prepared  by  the  Director,  Defense  Procurement  was  approved 
by  the  Principal  Deputy  Under  Secretary  of  Defense  for  Acquisition  and 
Technology  on  March  3,  1999.  The  Capstone  Plan  requires  the  Military 
Services  and  Defense  agencies  to  prepare  an  end-to-end  test  plan,  a  contingency 
plan,  and  a  continuity  of  operations  plan  for  each  procurement  system  that 
interfaces  with  other  systems.  Also,  the  Capstone  Plan  requires  the  Military 
Services  and  Defense  agencies  to  perform  end-to-end  testing  of  systems  to 
ensure  that  the  procurement  component  of  networked  systems  will  operate 
throughout  the  Y2K  transition. 

£nd-to-End  Testing.  The  DoD  Y2K  Management  Plan  defines  end-to-end 
testing  as  an  assessment  of  a  functional  area  to  determine  the  Y2K  readiness  of 
automated  information  systems  supporting  that  function.  End-to-end  testing 
increases  the  level  of  confidence  beyond  tiiat  provided  by  system-level  and 
acceptance  testing  performed  to  certify  that  systems  are  Y2K  compliant. 

Objectives 

The  overall  objective  was  to  evaluate  the  effectiveness  of  the  planned  Y2K 
end-to-end  tests  for  procurement  systems.  Specifically,  we  reviewed  the  test 
plans  and  the  results  of  selected  test  events  for  procurement  systems  that  were 
designated  as  mission-critical  and  non-mission  critical  by  the  Military  Services 
and  Defense  agencies,  to  determine  if  the  tests  were  adequately  planned  and 
executed,  and  the  results  were  adequately  documented.  See  Appendix  A  for  a 
discussion  of  the  audit  scope,  methodology,  and  prior  audit  coverage. 
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End-to-End  Testing  of  Procurement  Systems 

More  needs  to  be  done  to  provide  assurance  that  the  Defense  Logistics  Agency 
Mechanization  of  Contract  Administration  Services  procurement  system  will 
function  properly  in  the  year  2000.  The  Defense  Logistics  Agency  completed 
end-to-end  testing  of  mission  critical  procurement  systems  required  by  the 
Capstone  Plan.  However,  the  end-to-end  tests  did  not  include  external  interface 
testing  for  its  mission-critical  procurement  systems.  As  a  result,  the  Director, 
Defense  Lx)gistics  Agency  cannot  ensure  that  the  procurement  process  will  not 
be  adversely  affected  by  data  from  external  interface  partners. 

Planning  End-to-End  Tests 


End-to-end  test  planning  for  the  procurement  function  generally  met  the  requirements 
of  the  DoD  Y2K  Management  Plan.  As  the  Principal  Staff  Assistant  for  Procurement, 
the  Director,  Defense  Procurement  coordinated  the  Capstone  Plan  with  the  Military 
Services  and  Defense  agencies.  The  Capstone  Plan  provides  the  overall  strategy  for 
conducting  end-to-end  tests  of  procurement  systems  and  includes  the  test  plans 
submitted  by  the  Military  Services  and  Defense  agencies.  The  end-to-end  tests  were 
designed  to  replicate  production  information  flows  and  validate  that  data  flows  would 
continue  unaffected  across  networked  systems  for  the  critical  change  over  dates 
December  31,  1999,  to  January  1,  2000;  Febraary  28  to  February  29,  2000;  and 
Febmary  29  to  March  1,  2000,  as  identified  in  the,DoD  Y2K  Management  Plan.  The 
Capstone  Plan  requires  completion  of  end-to-end  mission-critical  systems  testing  by 
June  30,  1999,  and  non-mission  critical  systems  by  September  30,  1999. 

Identifying  Mission-Critical  Procurement  Systems 


The  Director,  Defense  Procurement  and  the  Principal  Deputy  Under  Secretary  of 
Defense  for  Acquisition  and  Technology  relied  on  the  Military  Services  and  Ae 
Defense  agencies  to  identify  their  mission-critical  procurement  systems  and  accepted 
their  submissions.  However,  the  Military  Services  and  Defense  agencies  were  not 
consistent  in  classifying  systems.  For  example,  the  Navy  classified  the  Integrated 
Technical  Item  Management  and  Procurement  System  (ITIMP)  as  mission  critical  while 
the  Army  and  Air  Force  classified  similar  systems  (Army  Procurement  Automated  Data 
and  Documentation  System  and  Air  Force  Automated  Contract  Preparation  System)  as 
non-mission  critical  systems.  The  following  systems  are  currently  designated  mission- 
critical  procurement  systems  requiring  end-to-end  testing:  the  Navy  ITIMP  system, 
DLA  Mechanization  of  (Contract  Administration  Services  (MOCAS),  DLA  Pre-Award 
Contracting  System  (DPACS),  and  SAMMS  Procurement  by  Electronic  Data  Exchange 
(SPEDE). 

Testing  Mission-Critical  Procurement  Systems 


Navy  ITBVIP  System.  The  Naval  Inventory  Control  Points  at  Philadelphia  and 
Mechanicsburg,  Pennsylvania,  use  the  ITIMP  system  to  automatically  process 
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solicitations,  solicitation  responses,  contract  awards,  and  contract  modifications.  The 
Fleet  Material  Support  Office  is  the  central  design  agent  for  the  ITIMP  system  and 
maintains  die  ITIMP  software.  The  Naval  Inventory  Control  Points  and  the  Fleet 
Material  Support  Office  are  subordinate  organizations  of  the  Naval  Supply  Systems 
Command.  The  solicitation  and  award  processes  are  the  essential  procurement 
processes  of  the  system. 

The  solicitation  process  begins  when  the  Uniformed  Inventory  Control  Program  (UICP) 
system,  an  inventory  management  system,  notifies  the  ITIMP  system  that  it  is  necessary 
to  buy  or  commercially  repair  an  item  for  stock  and  that  a  procurement  vehicle  does  not 
already  exist.  The  ITIMP  system  creates  a  solicitation  document  and  transmits  that 
document  to  the  Navy  Electronic  Commercial  On-Line  (NECO)  system.  The  NECO 
system  forwards  the  solicitation  to  vendors  qualified  to  offer  the  item  and  may  publish 
the  solicitation  on  its  web  site.  After  the  specified  time  period  has  elapsed,  offers  from 
interested  vendors  are  consolidated  and  the  ITIMP  system  forwards  the  information  to 
the  buyer  at  Ae  cognizant  Inventory  Control  Point.  The  buyer  selects  a  vendor  for 
contract  award  and  enters  the  information  in  the  ITIMP  system  to  begin  the  contract 
award  process.  The  solicitation  process  ends  when  the  ITIMP  system  forwards  the 
information  on  offers  to  the  responsible  buyer. 

The  contract  award  process  is  triggered  in  one  of  two  ways.  The  process  will  begin 
when  a  buyer  notifies  the  ITIMP  system  of  the  selected  vendor  for  contract  award  at  the 
end  of  the  solicitation  process.  Alternatively,  the  process  will  begin  when  the  UICP 
system  notifies  the  ITIMP  system  that  it  is  necessary  to  buy  or  commercially  repair  an 
item  for  stock  and  Aat  a  procurement  vehicle  already  exists.  The  ITIMP  system  creates 
the  award  document  and  forwards  it  to  the  NECO  system.  The  ITIMP  system  also 
creates  and  transmits  financial  and  inventory  information  to  the  UICP  system.  The 
NECO  system  electronically  transmits  the  award  document  to  the  vendor  and  pertinent 
award  information  to  the  MOCAS  system.  The  contract  award  process  ends  when  the 
NECO  system  transmits  the  award  document  to  the  vendor  and  award  information  to 
MOCAS. 

ITBMP  System  Testing.  The  Naval  Supply  Systems  Command  testing  officials 
organized,  coordinated,  and  supervised  the  end-to-end  testing  of  the  ITIMP  system. 

The  officials  conducted  testing  from  March  10  through  March  25,  1999,  using 
production  software  and  equipment  logically  partitioned  to  create  a  test  bed.  Because 
time  and  resource  constraints  prevented  testing  of  every  process  in  the  ITIMP  system, 
the  Naval  Supply  Systems  Command  functional  managers  selected  the  two  essential 
processes  of  the  system  (solicitation  and  contract  award)  for  testing.  The  test  began 
with  requirements  transmitted  by  the  UICP  system  to  the  ITIMP  system  for  processing. 
The  test  transactions  used  11  different  change  over  dates,  including  the  critical  change 
over  dates  required  by  Ae  DoD  Y2K  Management  Plan.  A  total  of  99  transactions 
comprising  5  stock  buys  and  4  repair  buys  for  each  of  the  1 1  test  dates  were  processed 
through  the  ITIMP  system  as  normal  production  runs.  The  interfaces  between  the 
ITIMP  system  and  the  UICP  and  NECO  systems  were  tested,  as  well  as  interfaces 
between  the  NECO  system  and  four  key  Navy  vendors  who  agreed  to  participate  in  the 
test.  The  interface  between  NECO  and  the  MOCAS  system  was  not  tested  because  the 
testing  officials  believed  MOCAS  would  process  the  test  transactions  as  live  (real) 
transactions  causing  production  problems.  Additionally,  DLA  had  no  plan  to 
coordinate  and  conduct  end-to-end  test  of  MOCAS  wiA  the  Navy. 
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ITBMP  System  Test  Results.  The  Naval  Supply  Systems  Command  testing  officials 
reported  that  the  end-to-end  testing  of  the  ITIMP  system  was  successful.  The  testing 
officials  used  a  normal  production  run  as  a  base  line.  The  testing  officials  identified 
expected  changes  in  output  for  the  test  transactions  and  used  the  automated  file  compare 
function  to  identify  changes  between  test  output  and  baseline  output.  The  testing 
officials  verified  that  data  in  non-date-related  fields  did  not  change,  and  that  only  the 
expected  date-related  changes  occurred.  All  test  transactions  processed  through  the 
system  correctly  with  one  exception.  The  NECO  system  software  failed  to  process 
transactions  with  the  Febmaty  29, 2000  date.  The  failed  ^plication  was  disengaged 
and  processing  continued  unintermpted  with  no  further  failures.  TTie  failure  was 
corrected  by  installing  a  software  release  that  included  correcting  the  February  29 
problem.  The  Nav^  Supply  Systems  Command  testing  officials  retested  the  system  on 
July  6,  1999.  The  retest  showed  that  transactions  dated  February  29, 2000  processed 
correctly.  TTie  Naval  Supply  Systems  Command  testing  officials  concluded  that  no 
significant  Y2K-driven  system  failures  would  occur  before,  during,  or  after  the  Y2K 
rollover.  We  believe  there  is  minimal  risk  that  NECO  transmissions  of  ITIMP  data  to 
MOCAS  will  fail  as  a  result  of  not  testing  the  NECO  -  MOCAS  interface  with  Y2K 
^tes.  The  NECO  system  has  been  transmitting  ITIMP  data  to  MOCAS  in  ANSI  X12 
format  without  problems  and  will  continue  to  use  ANSI  X12  format  in  year  2000. 

DLA  MOCAS  System.  The  Defense  Contract  Management  Command  and  the 
Defense  Finance  and  Accounting  Service  use  MOCAS  to  support  contract 
administration  and  payment  functions.  The  MOCAS  system  consists  of  nine  distinct 
subsystem  structures:  contract  maintenance,  material  control,  financial  management, 
contract  management,  quality  management,  program  and  technical  support, 
management  information,  system  support  and  operations  support.  Each  of  these 
subsystem  stmctures  supports  specific  business  functions  witiiin  the  Defense  Contract 
Management  Command  and  the  Defense  Finance  and  Accounting  Service. 

Additionally,  MOCAS  interfaces  with  at  least  32  external  systems  in  the  Military 
Services,  other  Defense  agencies,  other  Federal  agencies,  and  vendors  to  receive  and 
provide  information  on  contract  awards,  deliveries,  payments,  taxes  and  other 
information  needed  to  administer  contracts  and  manage  parents.  The  MOCAS 
system  includes  about  2,400  applications  with  about  1.5  million  lines  of  code  written  in 
COBOL  and  MANTIS. 

DLA  DPACS  System.  Procurement  personnel  at  the  Defense  Supply  Centers  use 
DPACS  to  automatically  prepare  solicitation  and  contract  award  packages  for  awards 
not  exceeding  $100,000.  The  DPACS  system  is  a  comprehensive  electronic  integrated 
contracting  system  that  supports  more  than  3,000  users  at  the  Defense  Supply  Centers. 
The  system  provides  all  of  the  purchase  request  management  data  that  a  buyer  needs  to 
complete  a  solicitation  and  award  package. 

DLA  SPEDE  System.  Procurement  personnel  at  the  Defense  Supply  Centers  use 
SPEDE  to  solicit  quotations,  receive  vendor  responses,  and  award  purchase  orders 
electronically  for  awards  not  exceeding  $25,000.  The  SPEDE  system  receives 
information  from  manual  sources,  internal  and  external  systems,  and  automatically 
prepares  the  appropriate  procurement  documents  for  transmission. 

MOCAS,  DPACS,  SPEDE  Systems  End-to-End  Testing.  The  DLA  Systems  Design 
Center  (DSDC)  in  Columbus,  Ohio,  was  responsible  for  the  end-to-end  testing  of 
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MOCAS,  DP  ACS,  and  SPEDE.  The  DSDC  testing  officials  conducted  tests  from 
April  5  through  April  9,  1999,  following  guidance  in  the  DLA  Systems  Cross 
Functional  End-to-End  Test  Plan  for  Y2K  Enterprise  Testing  (The  Logistics  Plan).  The 
Logistics  Plan  defines  three  levels  of  testing,  consisting  of  intra-component  (level  I), 
inter-component  (level  11),  and  post-test  activities  that  include  retest  (level  III).  The 
DLA  determined  that  all  MOCAS,  DPACS,  and  SPEDE  mission-critical  interfaces 
were  internal  to  DLA  and  scheduled  the  systems  for  level  I  testing  only.  The  DLA 
concluded  that  because  the  internal  interfaces  tested  are  the  same  interfaces  used  to 
communicate  with  systems  belonging  to  the  Militaty  Service  there  was  no  need  to  test 
the  interfaces  with  external  systems.  This  conclusion  assumes  that  the  owners  of  the 
external  systems  have  not  made  changes  to  communications,  application  software,  and 
equipment  that  would  impact  the  DLA  systems,  and  that  windows  used  to  interpret  the 
century  from  fte  year  are  matching.  The  Logistics  Plan  identified  the  direct  vendor 
delivery  process,  the  contract  award  process,  the  contract  shipment  process,  and  the 
shipment  ^ert  process  as  the  four  mission-critical  internal  threads  that  involved 
MOCAS,  DPACS,  or  SPEDE.  The  testing  process  consisted  of  four  cycles  with 
multiple  tests  of  the  mission-critical  threads.  For  example,  in  testing  the  contract  award 
process,  procurement  transaction  data  flows  were  tested  along  the  mission-critical 
thread  from  DPACS,  Arou^  three  different  logistics  systems,  and  finally  to  MOCAS. 
The  test  beds  were  logically  configured  to  match  the  production  environment,  and  the 
transactions  used  to  execute  the  tests  were  designed  by  system  users  to  maximize  the 
amount  of  data  exercised  and  provide  assurance  that  Ae  systems  performed  correctly. 

MOCAS,  DPACS,  SPEDE  Test  Results.  The  DSDC  testing  officials  reported  that 
end-to-end  testing  of  MOCAS,  DPACS  and  SPEDE  under  the  Logistics  Plan  was 
successfhl.  A  total  of  47  transactions  were  tested  for  MOCAS,  42  passed  and  5  were 
canceled  because  of  typing  errors.  The  five  canceled  tests  were  not  rerun  because  the 
errors  were  not  date  related  and  sufficient  tests  were  successfully  completed.  For 
DPACS,  13  transactions  were  successfully  tested  and  for  SPEDE,  4  transactions  were 
successfiilly  tested.  However,  the  tests  for  the  three  systems  only  addressed  intra¬ 
agency  (level  I)  processing.  The  level  I  tests  provide  reasonable  assurance  that 
MOCAS,  DPACS,  and  SPEDE  will  function  properly  within  DLA  during  the  Y2K 
transition,  and  limited  assurance  that  external  interfaces  will  function  properly.  On 
October  5,  1999,  DLA  issued  a  plan  to  test  DPACS  and  SPEDE  external  interfaces,  but 
had  no  plan  to  test  MOCAS  external  interfaces. 

Concerning  MOCAS  external  interfaces,  many  of  these  interfacing  systems  use 
standard  military  and  electronic  commerce/electronic  data  interchange  formats  that  will 
not  change  before  or  immediately  after  the  Y2K  transition.  This  means  that  the  year 
information  in  data  fields  is  kept  as  two  characters  and  the  receiving  system  determines 
Ae  century  using  a  windowing  technique.’  Therefore,  there  is  a  logic  change  in  the 
interface  even  if  the  physical  format  did  not  change.  For  an  interface  to  be  successful, 
Ae  window  used  by  the  sending  system  and  receiving  system  must  match.  The  window 
must  be  accurately  defined  and  communicated  to  the  sending  and  receiving  systems  for 
implementation.  Only  1  of  the  22  interface  agreements  between  MOCAS  and 


‘A  windowing  technique  establishes  a  lOO-year  range  of  acceptable  dates.  For  example,  a  50/50  window  can  be 
defined  as  a  2-digit  date  that  is  equal  to  or  greater  than  50  (95)  representing  a  year  in  the  20“*  century  (1995).  A 
2-di^t  year  ttiat  is  less  than  50  (01)  represents  a  year  in  die  21“  century  (2001). 
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interfacing  systems  accurately  defined  the  window.  Another  agreement  stated  a  75/25 
window  was  to  be  used,  but  did  not  ^ecify  how  the  75/25  would  be  interpreted. 
Therefore,  MOCAS  is  at  risk  of  corrupting  its  data  or  other  system's  data  because  of 
incorrect  determination  of  century  based  on  communicated  date  information.  Even  if 
an  interface  window  is  well  defined,  the  interface  should  be  tested  to  validate  that  both 
partners  are  using  the  same  window.  When  the  window  is  not  well  defined,  extra  effort 
is  needed  to  correct  this  deficiency.  To  provide  additional  assurance  diat  MOCAS 
interfaces  with  external  systems  will  function  properly  in  Y2K,  DLA  should  check  all 
MOCAS  external  interifaces  to  ensure  that  the  window  being  used  to  interpret  Ae 
century  from  the  year  is  clearly  defined  and  successfully  communicated  to  the  interface 
partners.  We  are  not  making  a  recommendation  concerning  DP  ACS  and  SPEDE 
because  on  October  5,  1999,  DLA  issued  a  draft  plan  to  test  DPACS  and  SPEDE 
external  interfaces  with  vendors.  On  November  1, 1999,  DLA  officials  advised  that 
the  tests  would  be  completed  by  November  19, 19^. 

Independent  Verification  and  Validation  of  Logistics  Plan  Level  I  Testing.  A  DLA 
contractor  supported  DSDC  by  performing  independent  verification  and  validation  of 
the  systems  tested.  The  contractor  gathered  test  results  for  each  system  and  verified 
that  the  actual  test  results  produced  were  the  same  as  the  expected  results.  The 
contractor  concluded  that  there  were  no  fmlures  in  the  tests  because  of  date  processing, 
and  that  no  Y2K  errors  were  found  during  the  system  test  or  the  independent 
verification  and  validation  process.  The  contractor  also  noted  that  DPACS  and  SPEDE 
external  interfaces  with  vendors  were  not  tested  and  recommended  further  testing  on 
DPACS  and  SPEDE  involving  at  least  a  few  vendors. 

Non-Mission  Critical  Systems 


The  Military  Services  and  Defense  agencies  identified  a  total  of  35  non-mission  critical 
procurement  systems.  The  Capstone  Plan  requires  that  testing  of  these  systems  be 
completed  by  September  30, 1999.  See  Appendix  B  for  a  listing  of  non-mission  critical 
procurement  systems  and  testing  status  as  of  September  1999. 

Contingency  and  Continuity  of  Operations  Plans 


The  Navy  and  DLA  prepared  Contingency  and  Continuity  of  Operations  Plans  for  each 
mission-critical  procurement  system  as  required  by  the  Capstone  Plan.  The  Navy 
tested  its  contingency  plan  for  ITIMP  during  exercise  Positive  Response,  which 
concluded  on  September  3,  1999.  The  DLA  completed  testing  of  the  contingency  plans 
for  MOCAS,  DPACS,  and  SPEDE  in  June  1999. 

Additional  Opportunities  to  IVfitigate  Risk 


There  are  additional  methods  that  DoD  organizations  can  use  to  reduce  the  risk  of 
mission-critical  procurement  system  failures  in  Y2K.  These  methods  include  testing  the 
interfaces  between  external  systems  and  using  code-scanning  tools  to  examine 
application  software. 
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Testing  External  Interfaces.  One  risk  mitigation  method  is  to  test  external  interfaces. 
End-to-end  testing  should  ensure  the  accurate  flow  of  data  through  the  interfaces. 
Accurate  flow  of  data  through  interfaces  is  critical  to  avoid  propagating  errors  from  one 
system  to  another. 

Automated  Scanning  of  Application  Software.  Another  risk  mitigation  method  is  to 
use  Y2K  automated  software-testing  tools  to  examine  application  software.  The  DoD 
placed  emphasis  on  computer  code  testing  and  purchased  software  for  scanning 
application  software  for  y2K  errors.  In  an  August  11,  1999,  memorandum,  the 
Assistant  Secretary  of  Defense  (Command,  Control,  Communications  and  Intelligence) 
strongly  recommends  that  every  DoD  organization  perform  software  maintenance  using 
automated  software  quality  and  testing  tools  to  verify  the  integrity  of  remediated  code. 
Some  DoD  organizations  had  already  planned  to  take  the  initiative  of  scanning  softwme 
codes  to  provide  additional  assurance  that  the  Y2K  risk  was  reduced.  For  example,  in 
October  1999,  DLA  stated  tiiat  it  is  using  both  commercial  and  in-house  software  to 
scan  application  software  for  Y2K  code  problems.  The  Inspector  General,  DoD, 
believes  that  code  scanning  should  be  used  aggressively  to  provide  additional  assurance 
that  mission-critical  systems  will  be  operational  in  Y2K  and  beyond,  especially  when 
any  douk  exists  about  the  executability  or  rigor  of  the  end-to-end  tests.  On  July  29, 
1999,  the  Inspector  General,  DoD,  announced  the  “Audit  of  the  Use  of  Analysis  and 
Renovation  Tools  for  Year  2000  Assurance.”  The  audit  will  evaluate  the  use  of 
automated  tools  to  scan  application  software  for  coding  errors. 

Conclusion 


The  end-to-end  tests  conducted  by  the  Navy  and  DLA  provided  reasonable  assurance 
that  mission-critictd  procurement  systems  will  operate  properly  internally  in  year  2000. 
The  Navy  test  also  provided  assurance  that  ITIMP  and  NECO  will  operate  properly 
with  external  interfaces  except  that  the  NECO  interface  with  the  DLA  MOCAS  system 
was  not  tested.  However,  we  believe  there  is  minimal  risk  that  NECO  transmissions  of 
ITIMP  data  to  MOCAS  will  fail.  The  NECO  system  has  been  transmitting  ITIMP  data 
to  MOCAS  in  ANSI  X12  format  without  problems,  and  will  continue  to  use  ANSI  X12 
format  in  Y2K.  The  DLA  tests  provided  limited  assurance  that  MOCAS,  DPACS,  and 
SPEDE  will  operate  properly  with  external  interfaces  because  the  external  interfaces 
were  not  tested.  The  DLA  plans  to  test  DPACS  and  SPEDE  external  interfaces  with 
vendors  by  November  19,  1999,  but  does  not  plan  to  test  MOCAS  external  interfac^. 
To  mitigate  the  risk  that  MOCAS  external  interfaces  will  fail  during  the  Y2K  transition, 
DLA  should  check  all  MOCAS  external  interfaces  to  ensure  that  the  window  being  used 
to  interpret  the  century  from  the  year  is  clearly  defined  and  successfully  communicated 
to  the  interface  partners. 

Management  Comments  on  the  Finding  and  Audit  Response 

DLA  Comments.  The  DLA  partially  concurred  with  the  Finding.  The  DLA  indicated 
that  the  test  between  tiie  MOCAS  and  DLA  internal  systems  can  also  be  considered  as  a 
test  of  the  MOCAS  external  interfaces.  The  DLA  stated  that  the  transaction  sets  tested 
between  MOCAS  and  the  internal  systems  are  identical  to  the  interfaces  between 
MOCAS  and  its  external  systems,  including  the  Navy  ITIMP  system.  The  DLA 


agreed,  however,  that  more  needs  to  be  done  to  provide  assurance  that  MOCAS  will 
function  properly  in  year  2000  and  stated  that  it  will  evaluate  and  assess  test  data, 
transmission  formats,  internal  and  external  interfaces,  windowing,  and  Memoranda  of 
Agreement  to  assure  the  risk  is  mitigated. 

Audit  Response.  The  DLA  comments  are  generally  responsive.  Because  DLA  agreed 
to  take  corrective  action  in  this  area,  no  additional  comments  are  required. 

Recommendation  and  Management  Comments 

We  recommend  that  the  Director,  Defense  Logistics  Agency  check  all  MOCAS 
external  interfaces  to  ensure  that  the  window  being  used  to  interpret  the  century 
from  the  year  is  clearly  defined  and  successfully  communicated  to  the  interface 
partners. 

Defense  Logistics  Agen^^  Comments.  The  Deputy  Director,  Defense  Logistics 
Agency  concurred,  stating  that  a  risk  mitigation  study  will  be  conducted  to  assure 
acceptable  risks  for  all  external  interfaces  between  MOCAS  and  the  45  systems  that  use 
it.  The  study  will  concentrate  on  the  specific  windowing  techniques  MOCAS  and  its 
external  partner  systems  use  and  the  Memoranda  of  Agreement  covering  the  external 
interfaces  and  windowing  techniques.  The  study  will  be  completed  by 
November  30,  1999. 
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Appendix  A.  Audit  Process 


This  report  is  one  in  a  series  being  issued  by  the  Inspector  General,  DoD,  in 
accordance  with  an  informal  partnership  with  the  Chief  Information  Officer,  DoD,  to 
monitor  DoD  efforts  to  address  the  Y2K  computing  challenge.  For  a  list  of  audit 
projects  addressing  the  issue,  see  the  Y2K  web  pages  on  the  IGNET  at 
http://www.ignet.gov. 

Scope 


We  reviewed  test  plans  and  available  documentation  supporting  end-to-end  tests  of 
procurement  systems  determined  by  the  Milita^  Services  and  Defense  agencies  as 
mission  critical  and  non-mission  critical.  We  interviewed  Army,  Navy,  Air  Force, 
DLA,  DISA,  DSDC,  and  NIMA  management  and  program  officials  involved  in  Y2K 
compliance  efforts  to  determine  the  status  of  their  Y2K  testing  efforts.  We  reviewed 
end-to-end  processes  and  test  results  at  the  Naval  Supply  Systems  Command  and  the 
Defense  Logistics  Agency  Systems  Design  Center.  Additionally,  we  interviewed 
officials  from  the  office  of  the  Director,  Defense  Procurement,  the  office  of  the 
Assistant  Secretary  of  the  Navy  (Research,  Development,  and  Acquisition),  and  DLA 
headquarters  to  discuss  oversi^t  of  implementation  of  the  Capstone  Test  Plan  for 
Procurement  Systems  for  Y2K  compliance. 

DoD- Wide  Corporate  Level  Government  Performance  and  Results  Act  Goals.  In 
response  to  the  Government  Performance  Results  Act,  the  Department  of  Defense  has 
established  2  DoD-wide  corporate  level  performance  objectives  and  7  subordinate 
performance  goals.  This  report  pertains  to  achievement  of  the  following  goal  (and 
subordinate  performance  goal): 

Goal  2:  Prepare  now  for  an  uncertain  future  by  pursuing  a  focused 
modernization  effort  that  maintains  U.S.  qualitative  superiority  in  key 
warfighting  ct^abilities.  Transform  the  force  by  exploiting  the  Revolution  in 
Military  Affairs,  and  reengineer  the  Department  to  achieve  a  21“  century 
infrastructure.  Performance  Goal  2.2;  Transform  U.S.  military  forces  for 
the  future.  (OO-DoD-2.2) 

DoD  Functional  Area  Reform  Goals.  Most  major  DoD  functional  areas  have  also 
established  performance  improvement  reform  objectives  and  goals.  This  report  pertains 
to  achievement  of  the  following  functional  area  objectives  and  goals. 

•  Information  Technology  Functional  Area.  Objective:  Become  a  mission 
partner.  Goal:  Serve  mission  information  users  as  customers.  (mVI-1.2) 

•  Tnfnrmafinn  Technology  Management  Functional  Issue  Area.  Objective: 
Provide  services  that  satisfy  customer  information  needs.  Goal:  Modernize 
and  integrate  DoD  information  infrastructure.  (nM-2.2) 
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•  Information  Technolo^  Management  Functional  Issue  Area.  Objective: 
Provide  services  that  satisfy  customer  information  needs.  Goal:  Upgrade 
technology  base.  (ITM-2.3) 

GAO  High  Risk  Area.  The  General  Accounting  Office  (GAO)  has  identified  several 
high-risk  areas  in  the  Department  of  Defense.  This  report  provides  coverage  of  the 
Information  Management  and  Technology  high-risk  area. 

Methodology 


Use  of  Computer-Processed  Data.  We  did  not  evaluate  the  general  and  application 
controls  of  the  ITIMP,  MOCAS,  DP  ACS,  and  SPEDE  systems,  although  we  used  data 
generated  by  those  systems  to  verify  that  test  transactions  matched  the  expected  test 
results.  We  did  not  evaluate  the  controls  because  the  test  transactions  were  processed 
using  production  software,  databases,  and  equipment  (partitioned  as  test  beds)  and  we 
had  no  reason  to  question  the  reliability  of  the  controls  for  the  production  systems. 
Nothing  came  to  our  attention  as  a  result  of  our  verification  procedures  that  caused  us 
to  doubt  the  reliability  of  die  computer-processed  data. 

Use  of  Technical  Assistance.  We  obtained  assistance  from  a  Computer  Engineer  in 
the  inspector  General,  DoD,  Audit  Followup  and  Technical  Support  Directorate.  The 
Computer  Engineer  assisted  in  the  evaluation  of  test  results  for  the  MOCAS,  DPACS, 
and  SPEDE  systems. 

Audit  Type,  Dates,  and  Standards.  We  performed  this  program  audit  from  April 
through  September  1999,  in  accordance  with  auditing  standards  issued  by  the 
Comptroller  General  of  Ae  United  States,  as  implemented  by  the  Inspector  General, 
DoD. 

Contacts  During  the  Audit.  We  visited  or  contacted  individuals  and  organizations 
within  DoD.  Further  detmls  are  available  upon  request. 

Management  Control  Program 


We  did  not  review  the  management  control  program  related  to  the  overall  audit 
objective  because  DoD  recognized  the  Y2K  issue  as  a  material  management  control 
weakness  area  in  the  FY  1998  and  FY  1999  Annual  Statements  of  Assurance. 

Summary  of  Prior  Coverage 

The  General  Accounting  Office  and  the  Office  of  the  Inspector  General,  DoD  have 
conducted  numerous  reviews  related  to  Y2K  issues.  General  Accounting  Office  reports 
can  be  assessed  over  the  Internet  at  http://www.gao.gov.  Inspector  General,  DoD 
reports  can  be  assessed  over  the  Internet  at  http://www.dodig.osd.mil. 
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Appendix  B.  Non-Mission  Critical  Procurement 

Systems  and  Testing  Status 


Non-Mission  Critical  Systems 


Army 

Standard  Army  Automated  Contracting  System  (SAACONS) 
Procurement  Automated  Data  and  Documentation  System  (PADDS) 

Navy 

Contract  Monitoring  Automated  System  (CMAS) 

Requisition  Automated  Processing  System  (RAPS) 

Small  Procurement  Electronic  Data  Interchange  (SPEDI) 

Integrated  Production  Management  System  (IPMS) 

Procurement  Contract  Monitoring  Automated  System  (PROCMAS) 
Navy  Electronic  Commerce  On-Line  (NECO) 

Purchase  Card  System  (PCS) 

Quicklook  Contracts  System  (QUICKLOOK) 

Air  Force 

Contract  Action  Reporting  System  (CARS) 

Contract  Action  Query  System  (CAQS) 

Contract  Profit  Reporting  System  (CPRS) 

Acquisition  Management  Information  System  (AMIS) 

Acquisition  and  Due-In  System  (ADIS) 

Contract  Information  Databa^  System  (CIDS) 

Automated  Contract  Preparation  System  (ACPS) 

Base  Contracting  Automated  System  (BCAS) 

Menu  Assisted  Data  Entry  System  (MADES) 

Defense  Information  Systems  Agency 

Contract  Status  Tracking  System  (CSTS) 

Contractual  On-Line  Procurement  System  (COPS) 

Rates  and  Tariffs  File  System  (RTFS) 

Web-Order  Entry  (WEB-OE) 

Defense  Intell^ence  Agency 

Standard  Automated  Contracting  System  (SACONS-Federal) 
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Defense  Logistics  Agency 

AGO  Modification  Module  Increment  11  (ACOMOD) 

Contract  Administration  Paperless  Automated  Support  System  (COMPASS) 

Contract  Audit  Follow-up  (CAFU) 

Customs  Duty  Free  Management  System  (CUSTOMS) 

Defense  Contract  Administration  Reimbursable  Reporting  System/Personnel 
Labor  Accounting  System  (DCARRS/PLAS) 

Defense  Contract  Management  Command  Information  Repository  Automated 
Metrics  System  (DIF^MS) 

Over  and  Above  System  (OASYS) 

Plant  Clearance  Automated  Reutilization  Screening  System  (PCARSS) 

Supplier  Information  Service  (SIS) 

Termination  Automated  Management  System  (TAMS) 

National  Imagery  and  Mapping  Agency 

Procurement  Request  Information  System  Windows  (WPRISM) 

The  non-mission  critical  procurement  systems  listed  above  have  been  certified 
Y2K  compliant. 

End-to-End  Testing  Status 

Army.  The  SAACONS  will  be  replaced  by  the  Standard  Procurement  System.  The 
Army  is  testing  those  SAACONS  interfaces  that  will  be  used  by  the  Standard 
Procurement  System  when  implemented.  As  of  October  30,  1999,  the  Army 
successfully  tested  all  but  one  of  SAACONS  prim^  interfaces  for  exchanging 
requirement  and  obligation  data.  The  Army  experienced  problems  with  the  load 
application  on  the  remaining  primary  interface.  On  November  1,  1999,  the  Army 
advised  that  it  was  working  to  resolve  the  problems  with  the  interface  and  complete 
SAACONS  testing.  The  Army  does  not  plan  to  test  PADDS  because  it  is  a  stand-alone 
system.' 

Navy.  The  Navy  completed  end-to-end  tests  of  two  of  its  eight  non-mission  critical 
systems.  The  end-to-end  test  of  RAPS  was  successfully  completed  May  22,  1999.  The 
NECO  system  was  end-to-end  tested  in  conjunction  witii  the  end-to-end  test  of  Navy 
ITIMP  system,  a  mission-critical  system.  The  test  was  successfully  completed  on 
July  6,  1999.  The  Navy  does  not  plan  to  test  the  other  six  systems. 

Air  Force.  The  Air  Force  does  not  plan  to  conduct  end-to-end  tests  but  is  performing 
independent  verification  and  validation  of  its  non-mission  critical  procurement  systems. 
The  Air  Force  anticipates  the  independent  verification  and  validation  will  be  completed 
by  December  1999. 

Defense  Information  Systems  Agency.  The  Defense  Information  Systems  Agency 
successfully  end-to-end  tested  the  COK,  RTFS,  and  WEB-OE  systems  in  July  1999. 
The  Defense  Information  Systems  Agency  does  not  plan  to  test  CSTS  because  it  is  a 
stand-alone  system. 
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Defense  Mtelligence  Agency.  The  Defense  Intelligence  Agency  does  not  plan  to  end- 
to-end  test  SACONS-Federal  because  it  is  a  stand-alone  system  that  does  not  interface 
with  other  systems. 

Defense  Log^ics  Agency.  The  Defense  Logistics  Agency  does  not  plan  to  end-to-end 
test  its  non-mission  critical  procurement  systems.  The  Defense  Logistics  Agency  stated 
that  all  its  non-mission  critical  procurement  systems  underwent  other  tests  that  made 
them  Y2K  compliant  and  certified. 

National  Imagery  and  Mapping  Agency.  The  National  Imagery  and  Mapping  Agency 
does  not  plan  to  end-to-end  test  the  WPMSM.  The  WPRISM  system  is  a  stand-alone 
procurement  system  that  provides  data  to  the  Defense  Finance  and  Accounting  Service 
Integrated  Accounts  Payable  System.  The  WPRISM  interface  with  the  Integrated 
Accounts  Payable  System  was  successfully  tested  in  August  1999. 
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Appendix  C.  Report  Distribution 


Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  for  Acquisition,  Technology,  and  Logistics 
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Assistant  Secretary  of  the  Army  (Financial  Management  and  Comptroller) 
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Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller) 
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Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 
Inspector  General,  Department  of  the  Air  Force 
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Other  Defense  Organizations 

Director,  Defense  Contract  Audit  Agency 
Director,  Defense  Information  Systems  Agency 

Inspector  General,  Defense  Information  Systems  Agency 
Chief  Information  Officer,  Defense  Information  Systems  Agency 
Director,  Defense  Logistics  Agency 

Chief  Information  Officer,  Defense  Logistics  Agency 
Director,  National  Security  Agency 

Inspector  General,  National  Security  Agency 
Inspector  General,  Defense  Intelligence  Agency 
Inspector  General,  National  Imagery  and  Mapping  Agency 


Non-Defense  Federal  Organizations 

Office  of  Management  and  Budget 

Office  of  Information  and  Regulatory  Affairs 
National  Security  Division  Special  Projects  Branch 
General  Accounting  Office 

National  Security  and  International  Affairs  Division 
Technical  Information  Center 

Defense  Information  and  Financial  Management  Systems,  Accounting  and  Information 
Management  Division 

Congressional  Committees  and  Subcommittees,  Chairman  and 
Ranking  Minority  Member 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 

Senate  Committee  on  Armed  Services 

Senate  Committee  on  Governmental  Affairs 

Senate  Special  Committee  on  the  Year  2000  Technology  Problem 

House  Committee  on  Appropriations 

House  Subcommittee  on  Defense,  Committee  on  Appropriations 
House  Committee  on  Armed  Services 
House  Committee  on  Government  Reform 

House  Subcommittee  on  Government  Management,  Information,  and  Technology, 
Committee  on  Government  Reform 

House  Subcommittee  on  National  Security,  Veterans  Affairs,  and  International 
Relations,  Committee  on  Government  Reform 
House  Subcommittee  on  Technology,  Committee  on  Science 
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Defense  Logistics  Agency  Comments 


IN  REPLY 
REFER  TO 


DEFENSE  LOGISTICS  AGENCY 
HEADQUARTERS 

8725  JOHN  J.  KINGMAN  ROAD,  SUITE  2S33 
FT.  BELVOIR,  VIRGINIA  22060^6221 


OCT  2  5  1999 

MEMORANDUM  ASSISTANT  INSPECTOR  GENERAL  FOR  AUDITING 
DEPARTMENT  OF  DEFENSE 

SUBJECT:  DoD  IG  Draft  Report,  Procurement  Systems  Year  2000  End-to-End 
Tests  (Project  No.  9CH-5047) 

The  following  comments  are  provided  in  response  to  your  October  8, 1999, 
request  in  the  subject  report  Defense  Logistics  Agency  (DLA)  partially  concurs 
with  the  finding  and  concurs  with  the  recommendation.  Comments  to  the  report 
are  shown  below. 

FINDING:  £nd-to-£nd  Testing  of  Procurement  More  needs  to  be  done  to 
provide  assurance  that  the  Defense  Logistics  Agency  Mechanization  of  Contract 
Administration  Services  procurement  system  will  fiinction  properly  in  the  year 
2000.  The  Defense  Logistics  Agency  completed  end-to-end  testing  of  mission 
critical  procurement  systems  required  by  the  Capstone  Plaa  However,  the  end- 
to-end  tests  did  not  include  external  int^ace  testing  for  its  mission-critical 
procurement  systems.  As  a  result,  the  Director,  Defense  Logistics  Agency  cannot 
ensure  that  the  procurement  process  will  not  be  adversely  afifected  by  data  from 
external  interface  partners. 

DLA  COMMENTS:  Partially  concur.  The  procurement  end-to-end  testing 
included  four  DLA  Mission  Critical  Procurement  Systems  (MOCAS,  SAMMS, 
SPEDE  and  DP  ACS).  The  testing  included  transmission  of  MILSCAP  and  ANSI 
X.  12  Electronic  Data  Interchange  (EDI)  transaction  sets  between  these  systems.  - 
The  MILSCAP  and  EDI  transaction  sets  tested  are  identical  to  the  interfaces 
between  MOCAS.  the  Navy’s  mission  critical  ITIMP,  and  other  external  systems. 
DLA  vrill  conduct  a  risk  migration  study  cm  intcrfeces  and  windowing.  The  study 
will  evaluate  and  assess  test  data,  MILSCAP  and  EDI  transmission  formats, 
internal  and  external  interfaces,  windovdng,  and  Memoranda  of  Agreement  to 
assure  the  risk  is  mitigated. 

RECOMMENDATION:  We  recommend  that  the  Director,  Defense  Logistics 
Agency  check  all  MOCAS  external  interftices  to  ensure  that  the  window  being 
used  to  interpret  the  century  from  the  year  is  clearly  defined  and  successfully 
communicated  to  the  interface  partners. 

DLA  COMMENTS:  Concur.  DLA  will  conduct  a  risk  mitigation  study  to 
assure  acceptable  risks  for  all  external  interfeces  between  MOCAS  and  the  45 
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systems  that  utilize  MOC  AS.  This  effort  will  include  mission  critical,  non¬ 
mission  critical,  and  unique  systems  internal  to  DLA  as  well  as  those  external 
systems  that  interface  with  MOCAS.  The  study  will  concentrate  on  the  specific 
windowing  techniques  MOCAS  and  its  external  partner  systems  are  using  and 
Memoranda  of  Agreement  covering  the  external  interfaces  and  windowing 
techniques.  Memoranda  of  Agreement  will  be  updated  or  implemented  where 
necessary.  The  study  will  also  evaluate  the  existing  interface  lest  results  and 
reports.  All  these  areas  will  be  evaluated  to  assure  that  Y2K.  data  can  be 
processed  effectively  between  MOCAS  and  its  partners.  This  will  assure  that  all 
interfaces,  including  MILSCAP  and  EDI  fonnats,  are  Y2K  compliant.  The  study 
will  be  completed  by  November  30, 1999. 

DISPOSITION: 

Action  is  Ongoing.  ECD:  November  30.  1999 

RAYMOND  ARCHER  HI 
Rear  Admiral.  SC,  USN 
Deputy  Director 
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Audit  Team  Members 


The  Contract  Management  Directorate,  Office  of  the  Assistant  Inspector  Geneid  for 
Auditing,  DoD,  prepared  this  report.  Personnel  of  the  Office  of  the  Inspector  General, 
DoD,  who  contributed  to  the  report  are  listed  below. 


Paul  J.  Granetto 
Garold  E.  Stephenson 
Eugene  E.  Kissner 
Dan  B.  Convis 
Arsenio  M.  Sebastian 
Johnetta  R.  Colbert 
Sandra  S.  Morrell 
Janice  Alston 
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